ClawHub
Back to skill

Security audit

Dementia Confusion / Disorientation Recognition and Orientation Soothing | 失智老人困惑/迷惘识别与定向安抚

Security checks across malware telemetry and agentic risk

Overview

This skill handles highly sensitive dementia-care audio/video and quietly relies on cloud services, local identity reuse, remote account/token handling, and possible automated interventions without enough user control or endpoint transparency.

Install only after confirming this will run in an authorized care setting with informed consent, visible notice, retention limits, and human oversight. Verify the backend endpoints, disable or gate automated soothing/escalation until reviewed, and make sure local identity and token storage are acceptable for your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (23)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
81% confidence
Finding
This code applies filter keys directly via getattr(self.__model__, key) using the caller-supplied filters dictionary. Although SQLAlchemy prevents classic SQL injection here, unvalidated attribute selection can let callers query on unintended columns, trigger exceptions for invalid attributes, and bypass business restrictions if higher layers pass user-controlled filter keys.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
81% confidence
Finding
As in list(), this count() method accepts arbitrary filter keys and turns them into model attribute lookups without validation. That can expose record-count side channels on unintended fields, cause denial-of-service through repeated exception-triggering inputs, or weaken access-control assumptions in code that relies on this generic DAO.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to use shell execution, local file handling, network access, and environment-backed identity behavior, yet declares no permissions or equivalent capability constraints. That mismatch is dangerous because it hides the real execution and data-access surface from reviewers and operators, increasing the chance of unintended file access, cloud queries, or command execution against sensitive dementia-care data.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The script exposes a `--pet-type` option and mutates a global default (`ConstantEnum.DEFAULT__PET_TYPE`) even though the skill is for dementia confusion/orientation analysis. This is a scope-integrity problem: it creates hidden, unrelated behavior and suggests the code was repurposed from another domain, which can cause incorrect downstream model routing, policy application, or analytics behavior in a sensitive healthcare context.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The CLI description and status text state the tool will 'trigger orientation soothing' even though the provided skill metadata describes analysis/detection only. In a dementia-care setting, overstating or silently expanding from passive analysis to intervention is dangerous because operators may rely on functionality that is undocumented, unaudited, or inappropriate for the care workflow.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill accepts arbitrary http/https video URLs and forwards them for backend analysis without any apparent allowlist, origin restriction, or trust validation. In a dementia-care surveillance context, this broadens the data intake far beyond the declared fixed-camera use case and can enable analysis of untrusted or privacy-sensitive third-party media, increasing misuse and compliance risk.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
This file exposes a generic API service with broad POST/PUT/GET/DELETE and CRUD helper methods that can be used to reach arbitrary URLs, which is far wider than what is needed for a skill whose stated purpose is dementia confusion/orientation analysis. Even if intended as shared infrastructure, this creates an unnecessary capability surface that could be repurposed by other code paths to perform unintended network actions, data access, or remote manipulation.

Context-Inappropriate Capability

Low
Confidence
84% confidence
Finding
The presence of a user lookup helper by username is not justified by the declared behavioral-analysis function and introduces account-enumeration or identity-correlation capability. In a dementia-care context, any unnecessary identity lookup increases privacy and misuse risk because the system may process sensitive resident, caregiver, or staff information.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The file defines a reusable shared user-account persistence layer, including identity fields, in a skill whose stated purpose is dementia confusion/orientation analysis from cameras and optional microphones. This capability is functionally unrelated and expands the data-collection surface, increasing the risk of unnecessary retention, cross-context profiling, and privacy harm for a highly sensitive population.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The User model stores token and open_token values even though the skill description covers behavioral analysis, not account/session management. Persisting authentication-style tokens in a local SQLite database materially raises the risk of credential theft, impersonation, and unauthorized access, especially given the mismatch between declared purpose and implemented capability.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This utility code performs remote account provisioning, token handling, and authenticated API communication that are unrelated to the declared dementia-orientation analysis purpose. In the context of a surveillance/healthcare skill, silently creating users and transmitting identifiers expands the data-exfiltration and unauthorized-service-use surface well beyond what a user would reasonably expect.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code derives identity from workspace files and a local user database, then persists or reuses that identity automatically. For a skill advertised as behavior analysis from cameras/microphones, this hidden identity initialization is unexpected and can bind user actions to local credentials without clear consent or necessity.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
These utilities discover workspace roots and create data/skills directories, providing broad filesystem reach unrelated to the stated dementia analysis behavior. While such helpers may be part of shared infrastructure, they still increase the capability surface for writing data or affecting other workspace contents if misused by the skill or dependent code.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The default trigger activates broadly whenever relevant audio/video is provided, with little scoping or exclusion logic. In a skill performing surveillance, biometric association, and behavioral inference on vulnerable adults, over-triggering can cause unintended processing of highly sensitive recordings and accidental invocation in contexts where consent, notice, or appropriateness has not been established.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill description presents surveillance, voice analysis, face/voice binding, and automated soothing of people with dementia without an upfront prominent warning that this is highly sensitive health-adjacent and biometric processing. That omission is dangerous because operators may deploy or invoke it without fully appreciating consent, privacy, legal, and ethical requirements for monitoring vulnerable individuals in homes or care facilities.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code performs hidden identity resolution through `OpenIdUtil.resolve_current_open_id(...)` without user-facing disclosure, while the `--open-id` parameter is suppressed from help output. In a healthcare-oriented skill processing highly sensitive video/audio data, undisclosed identity binding can lead to confusing data association, privacy violations, and accidental access to another subject's analysis history.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code reads the full local video file and uploads its contents to the analysis service with no user-facing notice, consent checkpoint, or minimization visible in this file. Because the skill processes highly sensitive health and surveillance footage of people with dementia, silent transmission materially increases privacy, legal, and data-governance exposure.

Missing User Warnings

Low
Confidence
71% confidence
Finding
The save routine overwrites the target path unconditionally and suppresses all exceptions, which can silently destroy existing configuration or hide failed writes. In a care-monitoring deployment, silent config corruption could disable safeguards, endpoints, or privacy-related settings without operators noticing.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Debug mode enables verbose urllib3/http.client logging, which can expose request URLs, payloads, and potentially authentication material or sensitive care-related data in logs. Given this skill's healthcare monitoring context, accidental logging of identifiers or behavioral observations is especially sensitive.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code reads data/smyx-api-key.txt and uses its contents as an internal identity source without visible disclosure. That creates covert coupling between local workspace secrets and network identity, which is risky and unexpected for a dementia-state analysis skill handling potentially sensitive environments.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The HTTP helper automatically attaches App-Id, tokens, API keys, authorization values, tenant code, and username to outbound requests without any user-facing notice in this file. In a care-facility monitoring skill, undisclosed transmission of authentication and identity metadata materially increases privacy, compliance, and account-abuse risk.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
92% confidence
Finding
This request posts user-identifying fields such as openId and mobile to an external login/provisioning endpoint. External transmission is not inherently malicious, but here it is not justified by the manifest's local confusion/orientation analysis purpose and can expose user identity or silently create remote accounts.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "smyx-dementia-confusion-orientation-analysis"
description: "Through fixed cameras (and optional microphones) in dementia care facilities or homes, the system analyzes behaviors of people with dementia to identify confusion/disorientation states: sudden activity stops (interrupting ongoing actions such as eating or walking for ≥ 5 seconds), gaze drifting (eyes wandering without focus), looking around (frequent head turning), and repeated disorientation questions ('Where is this?'. | 通过失智照护机构或家庭固定摄像头（及可选麦克风），分析失智老人的行为，识别困惑/迷惘状态：突然停止活动（中断正在进行的动作，如吃饭、行走 ≥ 5 秒）、眼神游离（视线漫无目的漂移、不聚焦）、四处张望（头部频繁转动）、反复询问'这是哪''现在几点''你是谁'等定向障碍问题（需配合声纹或语音识别）。"
version: "1.0.11"
license: "MIT-0"
---
Confidence
82% confidence
Finding
The manifest contains indicators associated with metadata/tool poisoning, likely due to malformed description content and suspicious/invisible characters. Even if not overtly malicious, poisoned or malformed metadata can mislead downstream parsers, policy engines, or reviewers about the skill's purpose and behavior, which is particularly risky for a skill handling sensitive surveillance and biometric workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2